Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad94e7a9dd3b3d13…

MALICIOUS

PDF

41.3 KB Authoring application: Karbon
MD5: 0fcbc2f137a1f1c816031ddd921b60de SHA-1: 876ce5cd2079f7467818d27287abb50d227d4a7f SHA-256: ad94e7a9dd3b3d13e48725831a2d39ea628ad26817ee5f6d42bac18ba92aa1ca
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the critical heuristic 'PDF_SEO_LINK_FARM' strongly indicate a malicious intent related to link farming and potentially phishing or malware distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jcckitchen.org/uploads/1/3/0/4/130491752/kazitebolufipamara.pdf
    • http://dwoslab.com/uploads/1/3/0/7/130775205/nowutof-xilemopaxizuzob.pdf
    • http://leaderfieldblog.com/uploads/1/3/0/5/130590778/vibamulajaxatuleke.pdf
    • http://stitchingkisses.com/uploads/1/3/0/6/130621525/jifiriledidid.pdf
    • http://ccportugal-cazaquistao.com/uploads/1/3/0/8/130873996/7863725.pdf
    • http://leacentre.com/uploads/1/3/0/2/130291910/a6f7611bd6.pdf
    • http://melbourneairbnb.com/uploads/1/3/0/5/130543256/4639274.pdf
    • http://randakksdevelopment.com/uploads/1/3/0/6/130639036/xegivokiguwevinoleve.pdf
    • http://teatemptations.com.au/uploads/1/3/0/4/130489342/betawebotusoj-guvitesimipek-jovevejadoj-bavipo.pdf
    • http://www.lensrip.com/uploads/1/3/0/4/130483385/xulexurepojat.pdf
    • http://kunzeartgallery.com/uploads/1/3/0/3/130379297/7864584.pdf
    • http://ncohouston.org/uploads/1/3/0/6/130604806/fezewepemenuzekuki.pdf
    • http://songhurstexperiment.com/uploads/1/3/0/6/130604848/386d44ce6ef0ca.pdf
    • http://beyondbedside.com/uploads/1/3/0/6/130604512/e3f9eb5d17fd724.pdf
    • http://bitcoinremittance.com/uploads/1/3/0/6/130604140/xugumosebakazabarewo.pdf
    • http://bolderlegal.com/uploads/1/3/0/6/130604949/nidaja.pdf
    • http://redfly112.redragonfly.com/uploads/1/3/0/2/130272981/muguwudetabisek.pdf
    • http://bettybiedermann.com/uploads/1/3/0/5/130590555/vepajopizixuz.pdf
    • http://webmail.jessicamiyuki.com/uploads/1/3/0/5/130541402/130541402.html#how+to+strengthen+weak+hip+abductors
    • http://teatemptations.com.au/uploads/1/3/0/4/1304893

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000396a.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x396A 2616 bytes
font_01_sfnt_off000044d8.bin
a3b2a1c3f7725fcbd374dfc49dee29400cb969187835ed70d1a658661aaa4611		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44D8 7424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.